CVE-2026-71430

CVE-2026-71430 in node-re2 exposes a severity mismatch that CVSS 6.2 fails to capture. The vulnerability stems from V8's ToLocalChecked API: when processing regex replacements that produce strings exceeding V8's internal length limits, ToLocalChecked doesn't throw a catchable exception—it calls abort() and terminates the process immediately. There is no error boundary, no graceful degradation, no retry opportunity. The entire Node.js runtime dies. The trigger is straightforward: any global replace operation using an output-amplifying replacement template (e.g., `str.replace(/pattern/g, (m) => 'x'.repeat(m.length * 2))`) on input large enough to push the result past V8's limit. This isn't exotic ReDoS payload construction—it's a plausible functional pattern that happens to hit an architectural cliff. For defenders, the priority actions are: audit your dependency trees for node-re2 versions below 1.25.1 and treat any finding as critical-severity despite the nominal 6.2 score; treat this crash as a denial-of-service vector in threat models since the blast radius extends beyond the regex operation to the entire service instance; and examine any other native addons calling ToLocalChecked without explicit MaybeLocal validation—the same pattern has appeared in multiple CVEs and likely exists elsewhere in the ecosystem. Static analysis tooling for unchecked MaybeLocal patterns is not mature, so manual code review of native addon V8 API usage is the most reliable detection method currently available. The deeper concern is systemic: node-re2 exists precisely because developers sought safety from ReDoS in native RegExp, yet that safety decision now introduces a crash vector with no recovery path. The CVSS framework was designed for contained failures, not process-terminating ones—apply appropriate skepticism to the score.

Reviewed through automated stages and approved by a human before publication.